Privacy policy

What SirTripsALot holds about you

• Your account. The email address you sign in with. With an emailed link or a passkey there is no password at all; a password, if you set one, is kept by the sign-in service only as a one-way hash, and nobody can read it back.

• Your trips and bookings. Flights, stays, activities, confirmation codes, seats, the names of the travelers on a booking, prices and points, and anything you type into a booking or a debrief. These are the point of the app.

• Ideas you add to a trip. A title, a place, a note, and a day, kept with the trip and deleted with it. A short Google Maps or Apple Maps link you share is opened by SirTripsALot’s server to find the place. If a shared map link names a place but doesn’t include its location, SirTripsALot sends the place’s name and any address in the link to Google Places to find it. Ideas stay on your own trip: they aren’t in a link you share, your calendar feed, or what an assistant you connect can see.

• Booking emails, if you connect a mailbox. With your permission SirTripsALot reads your Gmail or Outlook mailbox for booking confirmations. It doesn’t keep the rest of your mail, and it stops reading the moment you disconnect the mailbox. If you forward an email to your SirTripsALot address instead, only that email is read.

  For each email it acted on, it keeps the email’s text, up to 8,000 characters, so you can see why, along with any ticket or receipt attached to it, filed as a document on the trip.

  When it reads an email and doesn’t add it, because it isn’t travel, repeats a booking you already have, is a cancellation, or is one you dismissed before, it keeps the sender, the subject, when it arrived, what it read and the email’s text, up to 8,000 characters, so you can see why it was left out and add it anyway. It keeps the same when it tried to read an email and couldn’t. For an email from a sender you’ve marked as not travel, one it has already handled, or one your mailbox wouldn’t hand over, it keeps only the sender, the subject, and when it arrived. An email with no booking details in it, or one from another trip tracker, leaves no record. After 90 days each of these records is cleared down to your mailbox’s id for the message, which says nothing about the email and only tells SirTripsALot it has already looked.

  Separately, for emails turned away by their subject line alone, it keeps a short list so you can add one yourself: the sender, the subject, when it arrived, and your mailbox’s id for the message. This list doesn’t keep any email’s text or attachments. Only the most recent 25 per mailbox are kept, and older ones drop off. When you tap Add it, SirTripsALot fetches that one email from your mailbox again and reads it like any other booking email, so if it still isn’t added, it gets the record described above.

  Disconnecting a mailbox deletes its short list and your “Not a booking” answers for it. It doesn’t clear the other records above; deleting your account does.

• Documents you upload. Tickets, receipts, visas, and, in the vault, your passport, arrival form confirmations, and their photos. A visa’s or an arrival form’s country and dates are compared with your trips on your own trip pages, and nowhere else. They are stored privately, in your own folder, and shown only to you through links that expire after two minutes. On the phone, opening one asks for Face ID or Touch ID, or on Android the phone’s fingerprint, face, or screen lock; the check happens on the device and never reaches us.

• Where you are, while the app is open. Only if you allow it: to say how far you are from your next stop, to suggest the local currency in the currency converter, and to work out how long it takes to reach the airport. Your location is used on the phone, never sent to SirTripsALot, and not stored. To estimate the time to the airport, an iPhone asks Apple Maps for directions from your stay or your current location; Apple’s privacy policy covers that request.

• A notification token. If you allow notifications, the phone gives us a token so we can tell you when an airline changes a flight. Nothing else is sent through it. While a flight is on your iPhone’s Lock Screen, the phone gives us a second token for that display alone, so its gate and times can be updated there; we delete it when the flight is over.

• When you open the app. The app on your phone tells us when it’s opened, which phone it’s on (its model and its iOS or Android version), and which version of the app it is, and nothing else about how you use it. We keep the latest of these, and the dates of the days it was opened. When it was last opened is used for one thing: if you haven’t opened the app since your phone showed a reminder about check-in or an arrival form, we may send the same reminder by email. The phone and app version are used to label a report you send us as a tester, so we can see what you were using. Turn reminder emails off in Settings → Notifications, or from the link in any of them.

• Keeping the app working. To see whether new testers are getting set up, we look at what your account already shows: when you first signed in, whether you connected a mailbox or forwarded a booking, when your first trip was filed, and the days you opened the app. When something goes wrong in the app, on the web or on your phone, we record what failed and on which screen, as a fixed error code and the screen’s name, with the app’s version, an iPhone’s model, and the time, linked to your account so we can fix it for you. Errors on our own servers are recorded the same way, without being linked to an account. An error record names what failed, not what you typed or what your bookings, documents, or email say. We keep these records for 90 days, and deleting your account deletes the ones linked to it.

• Citizenship. Which countries you’re a citizen of, if you add them or a passport you saved shows it. It’s used only to decide which travel limits apply to you, such as the 90 days in Europe that EU, EEA, and Swiss citizens don’t have.

• Home airport, timezone, and currency. Set by you, or inferred from your flights and shown to you as such.

• Copies on your phone and in your browser. So your trips open without a connection, the app on your phone keeps a copy of your itineraries, and of any documents you download, on the phone. Signing out of the app deletes them. Downloaded documents are left out of the phone’s backups (iCloud and computer backups on an iPhone, Google’s on Android), because they can be downloaded again. On the web, a trip you save for offline is kept in that browser until you remove it from the trip’s page.

What it does with that

Builds your itinerary, counts your days in Europe against the 90-in-180 rule, counts the countries you have been to, converts expenses, works out what your points bought, and checks your passport’s expiry against your booked trips. Every calculation runs for you and is shown to you. Nothing is sold, nothing is used for advertising, and nothing is used to train anything.

Who else sees it

• The services that run SirTripsALot. Supabase stores the data and handles sign-in, and Vercel runs the site. Vercel also counts visits to the website: which page was opened, the site that linked to it, and your country, browser, and type of device. It sets no cookies, and the page address it receives never includes a trip, a share link, or anything after the page’s name. Postmark sends SirTripsALot’s emails and receives the bookings you forward and testers’ reports. Cloudflare runs the domain’s addresses and email routing, and stores SirTripsALot’s encrypted nightly backups; GitHub runs that backup, making the copy of the database before it is encrypted. Expo passes the app’s notifications on to Apple to deliver to an iPhone, or to Google’s Firebase Cloud Messaging to deliver to an Android phone, and SirTripsALot sends the flight on your iPhone’s Lock Screen to Apple directly: its flight number, airports, times, gate, and status. Test versions of the Android app reach testers through Google’s Firebase App Distribution, which holds each tester’s email address and details of the phone the app is installed on. Each holds what it needs on SirTripsALot’s behalf and under its instructions.

• Parsing. The text of a booking confirmation — one you paste, one you forward, or one SirTripsALot finds in a connected mailbox — is sent to an AI model (Anthropic’s Claude) to be turned into a structured booking. Only that email goes, never the rest of your mailbox, and Anthropic may not use it to train its models. A file you share to SirTripsALot is checked on SirTripsALot’s own server first: if it looks like one of your travel documents (a passport, visa, arrival form, or similar), it isn’t sent to an AI model at all. A receipt you scan into an expense is sent as a photo or PDF to the same AI model to read its total, currency, date, and the business’s name. When you scan a receipt, we read it and then delete it, unless you choose to keep it with the expense. A kept receipt is stored with your trip’s documents, and deleting the expense deletes it. A screenshot of a booking that you share or upload is read for its words: in the app on your phone they’re read on the phone itself, and only the words are sent to be read; uploaded on the web, or when the phone can’t read it, the picture is sent to the same AI model to write out its words. The words are then read like any booking you paste. Either way, a small copy of the picture is saved with the booking it adds, as one of its documents.

• Tester feedback. If you’re testing SirTripsALot and email feedback@sirtripsalot.com, or reply to your invitation, we keep that email: its subject and words, the screenshots attached to it, and the address it came from. If that address belongs to a SirTripsALot account, we link the report to the account and to the phone and app version the app last reported: the phone’s model, its iOS or Android version, and the app’s version. If you test the iPhone app and send feedback through TestFlight, Apple passes us what you sent: your comment, any screenshots, the email address of your Apple Account, your phone’s model and iOS version, the app’s version, and, after a crash, the crash report. We keep these and delete them with the reports emailed to us, as this section describes. We keep it to find and fix what testers report, and the person who runs SirTripsALot reads it. To sort each day’s reports, their words, not the screenshots or crash reports, are sent to an AI model (Anthropic’s Claude), which may not use them to train its models. The reports we act on are also read by the AI coding tools we use to fix what they describe. The reports and their screenshots are kept in private storage, and we delete all of them 90 days after SirTripsALot launches. The copies in our nightly database backups are gone within 30 days after that.

• Rates, weather, maps, and flights. Exchange rates come from SirTripsALot’s server, which asks free public rate services for them. Those requests carry only a currency and a date, nothing about you or your trip. Weather comes from Open-Meteo, place search from Google, a trip’s cover photo sometimes from Wikimedia, and flight status from an aviation data provider; SirTripsALot’s server asks them, and the request carries the place, the words you searched, or the flight number, never your name or account. Maps are different: they load straight from Mapbox or OpenStreetMap on the web, Apple Maps on an iPhone, and Google Maps on Android, so those services see your network address and the area the map shows. What the flight provider tells us (gates, terminals, delays, baggage belts) is cleared from your booking about a week after the flight; what your own confirmation said stays.

• People you share with. If you share a trip by link, anyone holding the link sees the itinerary: what, when, and where. Prices, booking references, other travelers, and documents are not included. You can replace or stop the link at any time.

• Your calendar, if you subscribe. Your trips’ calendar feed includes each booking’s times, places, and confirmation code. The calendar app you subscribe with keeps its own copy. Replacing the feed’s link in Settings stops new updates, but doesn’t remove what a calendar already holds.

• AI assistants you connect. If you connect an AI assistant such as Claude, ChatGPT, or Gemini to SirTripsALot, it can read your trips, bookings, spending, and countries when you ask it to. It can’t change anything, and it can’t see your travel documents, other travelers on a booking, or your emails. A booking SirTripsALot filed from a connected mailbox is shared like any other booking — its dates, places, confirmation code, and price — but never the email it came from or its attachments; you choose this when you allow the assistant. What it does with what it reads is governed by that assistant’s own terms. You can disconnect it at any time in Settings → Connections.

• Your mailbox provider. Connecting Gmail or Outlook goes through Google’s or Microsoft’s own consent screen, and you can revoke it there as well as in SirTripsALot.

Nobody else. There are no advertisers and no data brokers, and nothing follows you across other apps or sites.

Mail from Google and Microsoft

SirTripsALot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same rules apply to mail read from Microsoft Outlook.

• Mail is read with read-only access, only to find and file your bookings, and only for you.
• It is never sold, never used for advertising, and never used to train AI models, ours or anyone else’s.
• It is shared only with the services named above, and only to do that job: the parsing model reads a booking email to file it, and the storage provider holds what was filed.
• Nobody at SirTripsALot reads your mail. The only exceptions are when you ask us to look at a specific email to fix a problem, when it is needed for security, or when the law requires it.
• Disconnecting a mailbox in SirTripsALot’s Inbox deletes its access tokens and asks Google to revoke SirTripsALot’s access. You can also remove it from your Google account or your Microsoft account.

How your data is protected

What SirTripsALot holds from your mailbox, your bookings, and your documents is protected in these ways:

• Encrypted in transit. Everything between your browser or phone, SirTripsALot’s servers, its storage provider, and Google or Microsoft travels over HTTPS (TLS).

• Encrypted on the servers. The storage provider encrypts the database and stored files on its disks. The keys that let SirTripsALot read your mailbox (OAuth tokens) are also encrypted by SirTripsALot itself with AES-256-GCM, under a key held only on its servers, so the stored tokens are useless to anyone who reads the database without it.

• Only you can reach your data. Every row is tied to your account, and the database itself refuses any other account’s request for it (row-level security). SirTripsALot’s own server reaches it only to do the work described on this page. Your documents are in private storage, and each view is a link that expires after two minutes.

• The least access needed. Mail is read with read-only access. SirTripsALot keeps what it filed and the short excerpts described above, not your mailbox, and clears its record of emails it didn’t add after 90 days.

• Limited people. Only the people at M Ho Studios LLC who run SirTripsALot can reach the systems that hold your data, under the rules in “Mail from Google and Microsoft” above.

• On the phone. Your travel documents open only after Face ID or your passcode, or on Android the phone’s fingerprint, face, or screen lock. That’s a lock on opening them in the app, not separate encryption: the copies kept on the phone are protected by the phone’s own security, and a file you save or share out of the app is yours to look after.

How long it is kept

For as long as you have an account. Delete a booking, a document, or a trip and it is gone from your account then; disconnect a mailbox and its sync tokens are deleted then. The one thing kept for less time is the record of emails SirTripsALot looked at and didn’t add: after 90 days only the message’s id is left. SirTripsALot keeps its own nightly backup of the database, encrypted, and deletes each one after 30 days; the files you upload aren’t in it.

Deleting your account

You can delete your account yourself, inside the app: on the web under Settings → Account, on the phone at the bottom of Settings. Deleting removes your account, every trip and booking, every expense, every connected mailbox, and every file you uploaded, at once and permanently. If a file can’t be removed right away, a daily job keeps trying until it is. There is no waiting period and nothing to email us for. Two things last a little longer: the encrypted nightly backups, each deleted after 30 days, and, if we delete an account for you, a note in our own admin log that we did, whose email address is cleared after 90 days. Error records from our servers, which aren’t linked to any account, are deleted on their own 90-day schedule.

Updates list

If you sign up for updates, SirTripsALot keeps your email address and when you confirmed it, and uses your address only to tell you about SirTripsALot’s availability and news. Every email from the list has an unsubscribe link. Unsubscribing stops them and deletes your answers below; your address stays, marked unsubscribed, so it isn’t emailed again. An address that is never confirmed is deleted after 30 days. To limit sign-ups from any one network, it also keeps a one-way code made from the network address and browser a sign-up came from, never the address itself. Signing up is not an account. If you tick the tester box, SirTripsALot also keeps that choice and the devices you picked, and may email you an invitation to test. Testing starts only if you accept.

If you sign up from a link someone shared, SirTripsALot also keeps which link it was, and uses it to show the person who shared it how many people have joined the waiting list from their link. Your name and email address aren’t shown to them. If you’re later invited and make an account, your account notes who shared the link with you. That note is removed if either account is deleted, and the link record is removed when you unsubscribe or are taken off the list. You can also ask us to remove it and keep your account. Every account has its own share link, which is deleted with the account.

If you also answer “How do you travel?”, SirTripsALot keeps those answers with your email: your phone, where your booking emails arrive, how and how often you travel, your home country, how you organize your travel plans now, how important each feature is to you, and anything you write in the last box. Every question is optional. They’re used only to choose who tries SirTripsALot first and what to build next, are read by SirTripsALot alone, and are deleted when you unsubscribe.

Your choices

• Location, notifications, camera, and photos are each a permission the phone asks for, and each can be refused or withdrawn in the phone’s Settings without losing anything else.
• Face ID, or on Android the phone’s own lock, for the vault and for the app itself are switches in Privacy, on the phone.
• A connected mailbox can be disconnected from the Inbox at any time, on the web or the phone.

Children

SirTripsALot is not for children under 13 and does not knowingly hold their data.

Changes

When this page changes, the date at the top changes with it. Anything that widens what is collected will be said on the sign-in page before it takes effect.